A comprehensive digital audit conducted by cybersecurity experts has uncovered widespread vulnerabilities across Poland’s public infrastructure, leaving critical government bodies, healthcare systems, and transport hubs exposed to potential cyberattacks. The investigation revealed that over 10,000 public institutions and approximately 250,000 individual websites contain security flaws that could be exploited by malicious actors. Affected entities include regional airports, public hospitals, and critical administrative offices across the country.

Among the most severe findings was a critical flaw within Pad CMS, a widely used content management software. Because the developer had classified the software as end-of-life and discontinued security support, researchers were able to gain unauthorized access to more than 300 government websites without requiring authentication. Additionally, another system bug compromised approximately two-thirds of the national judiciary system, exposing around 245 court websites to potential high-level breaches.

The security deficit is further compounded by reluctant software vendors and systemic barriers to vulnerability reporting. Many vendors reportedly dismissed security notifications as minor inconveniences rather than urgent risks, while a general lack of structured bug bounty programs hindered proactive threat detection. Cybersecurity specialists Robert Kruczek and Kamil Szczurowski, who unveiled the findings at the Def Con convention in Las Vegas, emphasized that despite resistance, reporting these flaws directly to state authorities has helped strengthen national digital defenses.

These revelations come at a crucial moment for Poland as the nation works to fortify its critical assets against escalating cyber activity. Suspicious network intrusions targeting regional energy and water utilities—frequently linked to state-sponsored hacking groups—have underscored the urgent necessity of securing public sector digital networks. While significant vulnerabilities have since been reported and patched, experts warn that addressing legacy software dependencies remains a vital imperative for maintaining national security.

Key Takeaways

• An independent audit uncovered security flaws affecting over 10,000 Polish public entities and 250,000 websites, including courts and hospitals.
• Critical vulnerabilities in unsupported software, such as Pad CMS, allowed unauthenticated access to hundreds of official portals.
• The findings highlight urgent security risks amidst ongoing cyber threats targeting Eastern European critical infrastructure.

Editor’s Analysis & Impact

The audit of Poland’s public web infrastructure highlights a pervasive challenge facing government institutions globally: heavy reliance on legacy software and unsupported end-of-life systems. While public agencies frequently operate under tight budget constraints, neglecting software maintenance creates accessible targets for state-sponsored threat actors and cybercriminals alike. In light of heightened geopolitical tensions in Eastern Europe, particularly targeting critical utility networks, securing administrative and civil digital assets is vital. Moving forward, public sector entities must implement standardized vulnerability disclosure policies, establish structured bug bounty frameworks, and mandate strict decommission schedules for legacy software to prevent widespread exploitation.

Frequently Asked Questions

Q: What was the scope of the vulnerability scan conducted in Poland?
A: Researchers discovered over 10,000 public entities and 250,000 government-related websites harboring security flaws, including major transportation hubs, judicial systems, and medical centers.

Q: Why were so many Polish government websites exposed to cyber risks?
A: Many websites relied on unpatched or end-of-life software, such as Pad CMS, which lacked ongoing vendor support. Additionally, some software vendors dismissed bug reports and lacked official channels for vulnerability disclosure.

Q: How are authorities addressing these cybersecurity findings?
A: The researchers reported their findings directly through official government channels, allowing authorities to patch critical exposure points and bolster overall digital defenses.